| PVS: A prototype verification system S Owre, JM Rushby, N Shankar Automated Deduction—CADE-11, 748-752, 1992 | 2108 | 1992 |
| Formal verification for fault-tolerant architectures: Prolegomena to the design of PVS S Owre, J Rushby, N Shankar, F Von Henke Software Engineering, IEEE Transactions on 21 (2), 107-125, 1995 | 767 | 1995 |
| PVS: Combining specification, proof checking, and model checking S Owre, S Rajan, JM Rushby, N Shankar, M Srivas Computer Aided Verification, 411-414, 1996 | 650 | 1996 |
| Verification of secure systems JM Rushby University of Newcastle upon Tyne Computing Laboratory, 1981 | 555* | 1981 |
| Design and verification of secure systems JM Rushby ACM SIGOPS Operating Systems Review 15 (5), 12-21, 1981 | 551 | 1981 |
| Noninterference, transitivity, and channel-control security policies J Rushby SRI International, Computer Science Laboratory, 1992 | 455 | 1992 |
| A tutorial introduction to PVS J Crow, S Owre, J Rushby, N Shankar, M Srivas | 431 | 1995 |
| Bus architectures for safety-critical embedded systems J Rushby Embedded Software, 306-323, 2001 | 340 | 2001 |
| SAL 2 L De Moura, S Owre, H Rueß, J Rushby, N Shankar, M Sorea, A Tiwari Computer Aided Verification, 496-500, 2004 | 317 | 2004 |
| PVS language reference S Owre, N Shankar, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1 (2), 21, 1999 | 294 | 1999 |
| Partitioning in avionics architectures: Requirements, mechanisms, and assurance J Rushby SRI INTERNATIONAL MENLO PARK CA COMPUTER SCIENCE LAB, 2000 | 293 | 2000 |
| Using model checking to help discover mode confusions and other automation surprises J Rushby Reliability Engineering & System Safety 75 (2), 167-177, 2002 | 282 | 2002 |
| Formal methods and the certification of critical systems J Rushby SRI International, Computer Science Laboratory, 1993 | 256 | 1993 |
| An overview of SAL S Bensalem, V Ganesh, Y Lakhnech, C Munoz, S Owre, H Rueß, ... Proceedings of the 5th NASA Langley Formal Methods Workshop, 2000 | 234 | 2000 |
| Critical system properties: Survey and taxonomy J Rushby Reliability Engineering & System Safety 43 (2), 189-219, 1994 | 227 | 1994 |
| The PVS proof checker: A reference manual (beta release) N Shankar, S Owre, JM Rushby Computer Science Laboratory, SRI International, Menlo Park, CA, 1993 | 205 | 1993 |
| PVS prover guide N Shankar, S Owre, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1, 11-12, 2001 | 204 | 2001 |
| PVS system guide S Owre, N Shankar, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1 (5), 7, 1999 | 189 | 1999 |
| Formal methods and their role in the certification of critical systems J Rushby Safety and Reliability of Software Based Systems, 1-42, 1997 | 189 | 1997 |
| The PVS specification language (beta release) S Owre, N Shankar, JM Rushby Computer Science Laboratory, SRI International, Menlo Park, CA 94025, 1993 | 185 | 1993 |
